After Years Of Work With 40+ Revisions, Intel SGX Looks Like It Will Land In Linux 5.11

Assuming Linus Torvalds has no last minute objections, the long-in-development Intel SGX support will be merged into the mainline Linux kernel.

The Software Guard Extensions (SGX) enclaves support has undergone more than 40 rounds of review over the past few years while finally this morning it was sent in as an "x86/sgx" pull request for mainline.

Borislav Petkov who staged the patches under the TIP area and sent in these patches of Intel's this morning noted in the pull request, "please pull the Intel Software Guard eXtensions enablement. This has been long in the making, we were one revision number short of 42. :)"

Intel to now has offered SGX support via the patches and an out-of-tree kernel build.

Intel SGX is new hardware functionality that can be used by applications to populate protected regions of user code and data called enclaves. Once activated, the new hardware protects enclave code and data from outside access and modification.

Enclaves provide a place to store secrets and process data with those secrets. SGX has been used, for example, to decrypt video without exposing the decryption keys to nosy debuggers that might be used to subvert DRM. Software has generally been rewritten specifically to run in enclaves, but there are also projects that try to run limited unmodified software in enclaves.

Intel Software Guard Extensions has been supported since Skylake and the Linux support dates back even before then but this Linux kernel support has taken the longest. The SGX adoption hasn't been too vibrant due to the belated kernel support for mainline plus Spectre-like attacks and a number of attacks like Plundervolt, LVI, and SGAxe putting SGX into a compromising position.

But in any case Intel continues to work towards improving SGX from the hardware side and continued persevering in getting this Linux kernel support mainlined with ideally SGX helping to improve security around digital rights management, web browsing, encryption keys, and other security-related use-cases. Will we see an uptick in SGX usage now that the mainline Linux kernel support appears at the door? Only time will tell.